ColdFusion Markup Language

Synopsis

In its simplest form, like many other web scripting languages, CFML augments standard HTML files with database commands, conditional operators, high-level formatting functions, and other elements to produce web applications. CFML also includes many other constructs including ColdFusion Components (CFCs), CFML's version of objects, that allow separating business logic from presentation.

CFML can be written using either tags or CFScript, which resembles JavaScript (ECMAScript).

The pages in a CFML application include the server-side CFML tags and functions in addition to HTML tags. Modern CFML applications also tend to have CFCs that are accessed by the CFML pages for executing business logic. When a web browser requests a page in a ColdFusion application, it is automatically pre-processed by the ColdFusion application server.

CFML can also be used to generate other languages, aside from HTML, such as XML, JavaScript, CSS, and so on.

Despite the name, CFML is not a markup language. It is also not SGML, since certain core CFML features prevent it from complying.

The CFML engine is configured in such a way that certain file extensions on the server (.cfm, .cfc) are handed off to the CFML engine for processing. In the case of the Java-based engines this is accomplished via Java servlets. The CFML engine only processes CFML tags and functions; it returns text outside of CFML tags and functions to the web server unchanged.

7 more chapters are free with a Lably account.

History

Named Cold Fusion at the outset, the software was created in 1995 by the Allaire Corporation, originally located in Minnesota. It later moved to Cambridge, Massachusetts and then finally to Newton, Massachusetts before being acquired by Macromedia in 2001. Allaire Cold Fusion thus became Macromedia Cold Fusion. At the release of version 4, the space in the name was removed to become ColdFusion. Adobe acquired Macromedia in 2005. As of 2023, it is still actively developing ColdFusion.

In 1998 Alan Williamson and his Scottish company, "n-ary", began creating a templating engine for Java to simplify common programming tasks. Williamson was using curly-brace notation instead of tags, but when he saw an example of CFML and how it was solving similar problems (although not in Java) using a tag syntax, he started developing what would eventually become BlueDragon, which was the first Java implementation of the CFML language. (ColdFusion was written in C and C++ until version 6.0, the first Java-based version, was released in 2002.) New Atlanta licensed BlueDragon around 2001 and made it available as a commercial product, eventually creating a .NET implementation of CFML. Open BlueDragon is a fork of the commercial BlueDragon product and was first released in 2008.

The Railo CFML engine began as a student project in 2002 and was first launched as a commercial project in 2005. Railo announced they were making the engine open source in 2008, and the first open source version was released in 2009.

On June 18, 2009, Adobe announced at the CFUnited conference that it had formed a CFML Advisory Committee that would be responsible for guiding and reviewing changes to the CFML language. This effort was disbanded in 2010. The Google Group CFML Conventional Wisdom was created as a forum for open, public discussions about language and engine features; its use has dwindled since 2011.

In 2012, the OpenCFML Foundation was launched. Its function is to push open-source CFML applications and platforms.

Former Railo lead developer Michael Offner launched Lucee, a fork of Railo, in London on January 29, 2015. Backed by community supporters and members of the Lucee Association, the goal of the project is to provide the functionality of CFML using fewer resources, giving better performance and to move CFML past its roots and into a modern and dynamic Web programming platform.

In 2025, CFML was still in use. Lucee will hold a CFML conference, CFCAMP, on May 22-23, 2025. The Adobe ColdFusion Summit 2025 is to be held September 21-24, 2025.

Syntax

CFML tags have a similar format to HTML tags. They are enclosed in angle brackets (< and >) and generally have zero or more named attributes, though some tags (e.g. cfset, cfif) contain an expression rather than attributes. Many CFML tags have bodies; that is, they have beginning and end tags with text to be processed between them. For example:

<span id="mwcw"></span><span class="nb" id="mwdA"><cfoutput></span> <span class="p" id="mwdQ">#</span><span class="nv" id="mwdg">value</span><span class="p" id="mwdw">#</span> Bob! <span class="nb" id="mweA"></cfoutput></span>

Other tags, such as cfset and cfftp, never have bodies; all the required information goes between the beginning (<) character and the ending (>) character in the form of tag attributes (name/value pairs), as in the example below. If it is legal for tags not to have a body, it is syntactically acceptable to leave them unclosed as in the first example, though many CFML developers choose to self-close tags as in the second example to (arguably) make the code more legible.

<span id="mwfA"></span><span class="nb" id="mwfQ"><cfset</span> <span class="nv" id="mwfg">value</span> <span class="o" id="mwfw">=</span> <span class="s2" id="mwgA">"Hello"</span><span class="nb" id="mwgQ">></span> <span class="nb" id="mwgg"><cfset</span> <span class="nv" id="mwgw">value</span> <span class="o" id="mwhA">=</span> <span class="s2" id="mwhQ">"Hello"</span> <span class="o" id="mwhg">/</span><span class="nb" id="mwhw">></span>

Even if the tag can have a body, including a body may not be necessary in some instances because the attributes specify all the required information. In these cases, as with the second example above, the end tag (and hence, the tag body) may be omitted and the tag may be self-closing as in the following example:

<span id="mwjw"></span><span class="p" id="mwkA"><</span><span class="nt" id="mwkQ">cfexecute</span> <span class="na" id="mwkg">name</span><span class="o" id="mwkw">=</span><span class="s" id="mwlA">"C:\\winNT\\System32\\netstat.exe"</span> <span class="na" id="mwlQ">arguments</span><span class="o" id="mwlg">=</span><span class="s" id="mwlw">"-e"</span> <span class="na" id="mwmA">outputfile</span><span class="o" id="mwmQ">=</span><span class="s" id="mwmg">"C:\\Temp\\out.txt"</span> <span class="na" id="mwmw">timeout</span><span class="o" id="mwnA">=</span><span class="s" id="mwnQ">"1"</span> <span class="p" id="mwng">/></span>

Various tags offer the ability to type-check input parameters (e.g. cffunction, cfparam, cfqueryparam) if the programmer declares their type specifically. This functionality is used with cfqueryparam to secure web applications and databases from hackers and malicious web requests such as SQL injection.

Built-in tags

Nearly 100 tags and many more functions make up the heart of the CFML language. The following lists CFML tags by their function or purpose.

Application framework
Communications
Control
- Flow-control
- Database manipulation
- Exception handling
Data output
Debugging
Display management
Extensibility
File management
form
Internet Protocol
Page processing
Security
Variable manipulation
Other tags (cfimage, cfregistry etc.)

Custom tags

CFML allows language extensions in the form of custom tags, which are tags created by the developer that are not part of the CFML language itself. Custom tags are regular CFML files which are intended to be invoked as tags, although it is possible to treat a template as both a custom tag and a regular template. Custom tags are written in CFML and are typically invoked by prefixing the custom tag's file name with cf_, although there are other ways to invoke custom tags.

If a template is invoked as a custom tag, the attributes used to invoke that tag are available within the tag in an attributes scope and the variables for the calling page are accessible via the caller scope.

For example, if writing a custom tag to perform addition, taking two attributes and adding them together, the tag would be an addition.cfm file which could look like this:

<span id="mw0A"></span><span class="nb" id="mw0Q"><cfset</span> <span class="nv" id="mw0g">caller.addition</span> <span class="o" id="mw0w">=</span> <span class="nv" id="mw1A">attributes.first</span> <span class="o" id="mw1Q">+</span> <span class="nv" id="mw1g">attributes.second</span> <span class="o" id="mw1w">/</span><span class="nb" id="mw2A">></span> <span class="p" id="mw2Q"><</span><span class="nt" id="mw2g">cfexit</span> <span class="na" id="mw2w">method</span><span class="o" id="mw3A">=</span><span class="s" id="mw3Q">"exitTag"</span> <span class="p" id="mw3g">/></span>

Assuming the tag is in the same directory as the file (or in a pre-defined customtags directory), it can be invoked thus:

<span id="mw4g"></span><span class="p" id="mw4w"><</span><span class="nt" id="mw5A">cf_addition</span> <span class="na" id="mw5Q">first</span><span class="o" id="mw5g">=</span><span class="s" id="mw5w">"1"</span> <span class="na" id="mw6A">second</span><span class="o" id="mw6Q">=</span><span class="s" id="mw6g">"2"</span><span class="p" id="mw6w">></span>

CFX tags are custom tags which are developed using Java or C++, and are prefixed with cfx_ just like cf_. Java and C++ tags are added to the CFML runtime environment using the CFML engine's administrator or by editing configuration files.

On some CFML engines JSP tags can also be included in CFML pages using the <cfimport> tag.

Functions

ColdFusion Markup Language includes a set of functions used to perform logical and arithmetic operations and manipulate data.

ColdFusion Components (CFCs)

CFCs provide some (not all) of the typical features and functionality that are provided by object-oriented (OOP) languages. To create a CFC:

Create a file with a .CFC extension (this distinguishes CFCs from ColdFusion templates, which have a .CFM extension).

Use four tags to create the components, define their functions and arguments, and return a value.

<cfcomponent>: Defines a CFC
<cffunction>: Defines the functions (methods) within a CFC
<cfargument>: Defines the arguments (parameters) that a function accepts
<cfreturn>: Returns a value or result from a function

CFCs are plain CFML. Within a CFC any CFML tag, function, custom tag, other components, etc. may be used.

CFCs can be used in various ways. If a method contained in a CFC simply needs to be invoked, the <cfinvoke> tag will create an instance of the CFC, invoke the desired method, and then destroy the instance of the CFC. <cfinvoke> takes the name of the component (minus the .cfc extension) and the method to execute. To access any returned data, the RETURNVARIABLE attribute provides the name of a variable to contain whatever the function returns. CFCs are created using four tags, saved as .CFC files, and invoked using the <cfinvoke> tag.

In the example below, component temperature.cfc has a method FtoC which converts temperature from Fahrenheit to Celsius. The test.cfm template invokes the method and converts 212 degrees Fahrenheit and outputs the result.

<span id="mwAbg"></span><span class="cm" id="mwAbk"><!--- temperature.cfc ---></span> <span class="nb" id="mwAbo"><cfcomponent></span> <span class="nb" id="mwAbs"><cffunction</span> <span class="nv" id="mwAbw">name</span><span class="o" id="mwAb0">=</span><span class="s2" id="mwAb4">"FtoC"</span> <span class="nv" id="mwAb8">access</span><span class="o" id="mwAcA">=</span><span class="s2" id="mwAcE">"public"</span> <span class="nv" id="mwAcI">returntype</span><span class="o" id="mwAcM">=</span><span class="s2" id="mwAcQ">"numeric"</span><span class="nb" id="mwAcU">></span> <span class="nb" id="mwAcY"><cfargument</span> <span class="nv" id="mwAcc">name</span><span class="o" id="mwAcg">=</span><span class="s2" id="mwAck">"fahrenheit"</span> <span class="k" id="mwAco">required</span><span class="o" id="mwAcs">=</span><span class="s2" id="mwAcw">"yes"</span> <span class="nv" id="mwAc0">type</span><span class="o" id="mwAc4">=</span><span class="s2" id="mwAc8">"numeric"</span> <span class="o" id="mwAdA">/</span><span class="nb" id="mwAdE">></span> <span class="nb" id="mwAdI"><cfset</span> <span class="nv" id="mwAdM">answer</span><span class="o" id="mwAdQ">=</span> <span class="p" id="mwAdU">(</span><span class="nv" id="mwAdY">fahrenheit</span> <span class="o" id="mwAdc">-</span> <span class="m" id="mwAdg">32</span><span class="p" id="mwAdk">)</span><span class="o" id="mwAdo">*</span><span class="m" id="mwAds">100</span><span class="o" id="mwAdw">/</span><span class="m" id="mwAd0">180</span> <span class="o" id="mwAd4">/</span><span class="nb" id="mwAd8">></span> <span class="nb" id="mwAeA"><cfreturn</span> <span class="nv" id="mwAeE">answer</span> <span class="o" id="mwAeI">/</span><span class="nb" id="mwAeM">></span> <span class="nb" id="mwAeQ"></cffunction></span> <span class="nb" id="mwAeU"></cfcomponent></span> <span class="cm" id="mwAeY"><!--- test.cfm ---></span> <span class="nb" id="mwAec"><cfset</span> <span class="nv" id="mwAeg">fDegrees</span> <span class="o" id="mwAek">=</span> <span class="m" id="mwAeo">212</span> <span class="o" id="mwAes">/</span><span class="nb" id="mwAew">></span> <span class="nb" id="mwAe0"><cfinvoke</span> <span class="k" id="mwAe4">component</span><span class="o" id="mwAe8">=</span><span class="s2" id="mwAfA">"temperature"</span> <span class="nv" id="mwAfE">method</span><span class="o" id="mwAfI">=</span><span class="s2" id="mwAfM">"FtoC"</span> <span class="nv" id="mwAfQ">returnvariable</span><span class="o" id="mwAfU">=</span><span class="s2" id="mwAfY">"result"</span><span class="nb" id="mwAfc">></span> <span class="p" id="mwAfg"><</span><span class="nt" id="mwAfk">cfinvokeargument</span> <span class="na" id="mwAfo">name</span><span class="o" id="mwAfs">=</span><span class="s" id="mwAfw">"fahrenheit"</span> <span class="na" id="mwAf0">value</span><span class="o" id="mwAf4">=</span><span class="s" id="mwAf8">"#fDegrees#"</span> <span class="p" id="mwAgA">/></span> <span class="nb" id="mwAgE"></cfinvoke></span> <span class="nb" id="mwAgI"><cfoutput></span><span class="p" id="mwAgM">#</span><span class="nv" id="mwAgQ">fDegrees</span><span class="p" id="mwAgU">#</span><span class="ni" id="mwAgY">&deg;</span>F = <span class="p" id="mwAgc">#</span><span class="nv" id="mwAgg">result</span><span class="p" id="mwAgk">#</span><span class="ni" id="mwAgo">&deg;</span>C<span class="nb" id="mwAgs"></cfoutput></span> <span class="p" id="mwAgw"><</span><span class="nt" id="mwAg0">br</span> <span class="p" id="mwAg4">/></span>

CFCs may also be instantiated as objects. Assuming a CFC file called Person.cfc, an instance of this CFC would be instantiated as follows:

<span id="mwAhI"></span><span class="nb" id="mwAhM"><cfset</span> <span class="nv" id="mwAhQ">person</span> <span class="o" id="mwAhU">=</span> <span class="nf" id="mwAhY">CreateObject</span><span class="p" id="mwAhc">(</span><span class="s2" id="mwAhg">"component"</span><span class="p" id="mwAhk">,</span> <span class="s2" id="mwAho">"Person"</span><span class="p" id="mwAhs">)</span> <span class="o" id="mwAhw">/</span><span class="nb" id="mwAh0">></span>

CFCs also form the basis of the ability to create web services in CFML. A CFC is created in the usual way, and the attribute access="remote" added to any function within the CFC will make that function available to be called as a SOAP-based web service. The CFML engine auto-generates a WSDL and creates all the necessary stubs for the web service to function.

Security updates

Adobe releases security patches for ColdFusion as needed, typically in response to identified vulnerabilities. These updates address critical issues such as arbitrary code execution and security feature bypasses. For instance, on December 23, 2024, Adobe released updates for ColdFusion 2023 and 2021 to resolve a critical vulnerability that could lead to arbitrary file system read. To stay informed about the latest security updates, users should regularly check Adobe's official ColdFusion security bulletins. Additionally, subscribing to Adobe's security notification service ensures timely alerts about new patches and vulnerabilities. Implementing these updates promptly is crucial to maintaining the security and integrity of ColdFusion applications.